When 911 Goes Dark: China-Nexus Backdoors, Access Brokers Selling Government Networks, and a Wake-Up Call for State IT Leaders

Public Sector

Published on

April 24, 2026

Table of Contents

Threat Assessment Level: ELEVATEDUnchanged from the prior assessment period. The convergence of nation-state espionage tooling linked to China-nexus operations, actively exploited critical vulnerabilities in government-used platforms, and access brokers explicitly selling state and local government network access sustains this elevated posture. <h2>Executive Summary                       </h2> State government networks are under coordinated pressure from multiple directions this week. On April 23, CISA took the unusual step of publishing a malware analysis report for a newly identified backdoor called FIRESTARTER on the same day it released a joint Five Eyes advisory on China-nexus compromise of network devices — a pattern that historically signals a coordinated government response to an active espionage campaign. Separately, a vulnerability in Intrado 911 Emergency Gateway systems — the infrastructure that routes 911 calls — now has a CISA advisory warning that attackers can read, modify, or delete files on these life-safety systems. And an access broker known as HOOK SPIDER, whose client list reads like a who’s-who of ransomware operators, updated its profile this week with explicit targeting of government and local government entities across 66 countries, including the United States. This is not theoretical. These are concurrent, active threats to the systems state agencies depend on every day. <h2>What Changed                                  </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> 7 Apr 2026 </td> <td> Researcher “Chaotic Eclipse” releases PoC for CVE-2026-33825 (BlueHammer) — Microsoft Defender privilege escalation </td> <td> Lowers the barrier for exploitation of a tool deployed on virtually every state Windows endpoint </td> </tr> <tr> <td> 16 Apr 2026 </td> <td> Huntress Labs confirms BlueHammer exploited in the wild </td> <td> Moves from theoretical to confirmed threat; CISA KEV mandatory remediation deadline: 7 May 2026 </td> </tr> <tr> <td> 20 Apr 2026 </td> <td> ClickFix → NETSUPPORT RAT campaign updated, explicitly targeting government </td> <td> Social engineering technique tricks users into pasting malicious PowerShell — bypasses email security </td> </tr> <tr> <td> 22–23 Apr 2026 </td> <td> CISA adds two new KEV entries in 48 hours </td> <td> Signals elevated exploitation activity across the vulnerability landscape </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> CISA publishes FIRESTARTER backdoor MAR (AR26-113A) alongside China-nexus advisory (AA26-113A) </td> <td> Sequential report numbering and same-day publication suggest linked investigation into government-targeting espionage </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> ESET discloses GopherWhisper — China-aligned APT using M365 Graph API draft-email dead-drops for C2 </td> <td> Abuses the same Microsoft 365 environment state agencies rely on for daily operations </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> CISA/Five Eyes joint advisory AA26-113a on China-nexus compromised SOHO routers and edge devices </td> <td> State agency branch offices and remote sites often use exactly these device types </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> Iranian espionage campaign updated — custom backdoors + legitimate RATs targeting government across 17 countries </td> <td> Expands the nation-state threat beyond China-nexus to include Iran-nexus actors </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> CISA ICS advisory for Intrado 911 Emergency Gateway file manipulation vulnerability </td> <td> Direct threat to state-operated or state-overseen 911 dispatch infrastructure </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> CoinbaseCartel posts new government victim — exfiltration-only, no encryption </td> <td> Data theft without ransomware means no obvious alert fires; stolen PII has high criminal market value </td> </tr> <tr> <td> 24 Apr 2026 </td> <td> HOOK SPIDER access broker profile updated — sells gov/local-gov network access to ransomware affiliates </td> <td> A HOOK SPIDER sale today becomes a ransomware incident in 2–14 days </td> </tr> </tbody> </table> <h2>Threat Timeline                                 </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Event </th> <th> Threat Category </th> </tr> </thead> <tbody> <tr> <td> 7 Apr </td> <td> BlueHammer PoC released (CVE-2026-33825) </td> <td> Vulnerability / Privilege Escalation </td> </tr> <tr> <td> 16 Apr </td> <td> BlueHammer confirmed exploited in the wild </td> <td> Active Exploitation </td> </tr> <tr> <td> 20 Apr </td> <td> ClickFix → NETSUPPORT campaign targets government </td> <td> Social Engineering / RAT Delivery </td> </tr> <tr> <td> 22 Apr </td> <td> CISA KEV addition #1 </td> <td> Active Exploitation </td> </tr> <tr> <td> 23 Apr </td> <td> CISA KEV addition #2 </td> <td> Active Exploitation </td> </tr> <tr> <td> 23 Apr </td> <td> FIRESTARTER MAR (AR26-113A) published </td> <td> Nation-State Espionage (China-nexus) </td> </tr> <tr> <td> 23 Apr </td> <td> AA26-113a: China-nexus compromised device networks </td> <td> Nation-State Infrastructure Compromise </td> </tr> <tr> <td> 23 Apr </td> <td> GopherWhisper M365 C2 disclosed </td> <td> Nation-State Espionage (China-nexus) </td> </tr> <tr> <td> 23 Apr </td> <td> Iranian espionage campaign updated — 17 countries </td> <td> Nation-State Espionage (Iran-nexus) </td> </tr> <tr> <td> 23 Apr </td> <td> Intrado 911 EGW advisory (ICSA-26-113-06) </td> <td> Critical Infrastructure Vulnerability </td> </tr> <tr> <td> 23 Apr </td> <td> CoinbaseCartel posts new government victim </td> <td> Data Extortion </td> </tr> <tr> <td> 24 Apr </td> <td> HOOK SPIDER profile updated — gov targeting confirmed </td> <td> Access Brokering / Ransomware Enablement </td> </tr> <tr> <td> 7 May </td> <td> CISA KEV deadline: BlueHammer (CVE-2026-33825) </td> <td> Compliance Deadline </td> </tr> </tbody> </table> <h2>Key Threat Analysis                              </h2> <h3>1. FIRESTARTER and the China-Nexus Espionage Convergence</h3> CISA’s simultaneous publication of the FIRESTARTER backdoor malware analysis report (AR26-113A) and the China-nexus compromised device advisory (AA26-113A) is the most significant signal this week. The sequential report numbering — AR26-113A and AA26-113A — strongly suggests these are products of the same investigation. If FIRESTARTER is the backdoor deployed through the compromised SOHO router and edge device infrastructure described in AA26-113A, the implications for state government are severe. State agencies operate hundreds of branch offices, field locations, and remote sites that commonly use exactly the types of small office routers and network appliances called out in the advisory. These devices are often managed by local staff or MSPs with limited security visibility. This sits alongside two other active China-nexus operations: <ul> <li>GopherWhisper — A newly disclosed APT that abuses Microsoft 365 Graph API draft-email folders as dead-drop C2 channels, with Slack and Discord as backup communication paths. For any state agency running M365 (which is nearly all of them), this means the adversary’s command-and-control traffic looks like normal productivity suite API calls.</li> <li>Volt Typhoon — The ongoing campaign targeting critical infrastructure through compromised network devices, tracked continuously since prior reporting periods.</li> </ul> Bottom line: China-nexus actors are running multiple parallel operations that target the exact technology stack most state governments depend on — M365 for productivity, SOHO routers at branch offices, and edge network devices at agency perimeters. <h3>2. Intrado 911 Emergency Gateway — A Life-Safety Vulnerability</h3> CISA advisory ICSA-26-113-06 discloses a vulnerability in the Intrado 911 Emergency Gateway (EGW) — the system Public Safety Answering Points (PSAPs) use to route 911 calls. Successful exploitation allows an attacker to read, modify, or delete files on the system. This is not a typical IT vulnerability. This is a life-safety system. File manipulation on a 911 gateway could disrupt call routing during an emergency, redirect calls, or corrupt dispatch data. States operate or oversee 911 infrastructure, and this system may not appear in standard IT asset inventories because it is managed by public safety agencies or third-party 911 service providers. This is the first CISA advisory specifically targeting 911 dispatch infrastructure in the current tracking period, making it a novel and high-priority finding. <h3>3. HOOK SPIDER: The Access Broker Selling Your Network to Ransomware Gangs</h3> HOOK SPIDER (also known as Pirat-Networks, BenjaminFranklin, Big-Bro, and crasty_bro) is an access broker — a criminal actor who compromises networks and then sells that access to ransomware operators. Their profile was updated on April 24 with confirmed targeting of government and local government across 66 countries including the United States. What makes HOOK SPIDER a force multiplier is their client list. They sell access to: <ul> <li>SCATTERED SPIDER — Known for sophisticated social engineering and SIM-swapping</li> <li>VICE SPIDER — Ransomware affiliate</li> <li>ALPHA SPIDER (BlackCat/ALPHV successor operations)</li> <li>WANDERING SPIDER</li> <li>Nova RaaS operators</li> </ul> HOOK SPIDER uses commodity info-stealers (RedLine, Vidar) and the ProxyShell exploit chain to gain initial access. A single successful HOOK SPIDER compromise of a state agency network could be handed off to any of these ransomware operators within days. The active ransomware landscape reinforces this concern: <ul> <li>DragonForce — 492 confirmed victims, updated April 22</li> <li>CoinbaseCartel — 164 victims, new victim posted April 23, including a government ministry</li> <li>Everest, Qilin, Lynx, Termite, Nightspire, SafePay, IncRansom — All active and tracked</li> </ul> <h3>4. CoinbaseCartel: Data Theft Without the Ransomware Alert</h3> CoinbaseCartel represents an evolution in the extortion model that is particularly dangerous for government. They explicitly state they “never involve system encryption or operational disruption.” Instead, they steal data and extort victims with the threat of publication. Their TTPs include: - Abuse of valid cloud accounts (T1078.004) - Vishing (voice phishing) for initial access (T1566.004) - Exfiltration to cloud storage services For state agencies holding driver’s license records, tax data, Medicaid information, and voter rolls, this model is insidious: there is no ransomware detonation to trigger an alert. Detection depends entirely on data loss prevention (DLP) controls and user/entity behavior analytics (UEBA) — capabilities that many state agencies have not fully deployed. <h3>5. Iranian Espionage Campaign Expands</h3> An active Iranian-nexus espionage campaign was updated on April 23, targeting government, education, energy, telecommunications, utilities, and non-profit sectors across 17 countries. The actors deploy custom backdoors alongside legitimate remote access tools — a hallmark of MuddyWater (also known as Seedworm, assessed as Iranian MOIS-affiliated) and APT34 tradecraft. While no U.S. state government victims have been confirmed in this campaign, the targeting profile aligns closely with state agency verticals (government, education, energy, utilities). MuddyWater is assessed with moderate probability to target U.S. state networks within the next 14 days. <h3>6. ClickFix Social Engineering Targets Government Users</h3> A financially motivated campaign is using the ClickFix technique to deploy NETSUPPORT RAT against government targets. ClickFix tricks users into copying and pasting malicious PowerShell commands — often disguised as browser error “fixes.” Because the user manually executes the command, this technique bypasses email security gateways and many endpoint protections that focus on file-based delivery. <h3>7. Critical Vulnerabilities Requiring Immediate Attention</h3> <table> <thead> <tr> <th> CVE </th> <th> Product </th> <th> CVSS </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-33825 (BlueHammer) </td> <td> Microsoft Defender </td> <td> — </td> <td> Exploited in the wild; KEV deadline 7 May 2026 </td> </tr> <tr> <td> CVE-2026-1340 </td> <td> Ivanti Endpoint Manager Mobile (EPMM) </td> <td> 9.8 </td> <td> Actively exploited per campaign data </td> </tr> <tr> <td> CVE-2026-1281 </td> <td> Ivanti Endpoint Manager Mobile (EPMM) </td> <td> 9.8 </td> <td> Actively exploited per campaign data </td> </tr> <tr> <td> CVE-2026-1731 </td> <td> BeyondTrust Remote Support / Privileged Remote Access </td> <td> 9.8 </td> <td> Active exploitation campaign confirmed; reconnaissance activity observed (GreyNoise) </td> </tr> </tbody> </table> All four vulnerabilities affect products commonly deployed in state government environments. The two Ivanti EPMM vulnerabilities are particularly concerning for agencies using Ivanti for mobile device management, and the BeyondTrust vulnerability directly impacts privileged access management — the keys to the kingdom. <h2>Predictive Analysis                             </h2> Based on current threat actor operational tempo, vulnerability exploitation patterns, and targeting data: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CISA publishes follow-up linking FIRESTARTER to a specific China-nexus actor group with additional IOCs </td> <td> 70% </td> <td> 7 days </td> <td> Same-day publication pattern with sequential numbering historically precedes attribution </td> </tr> <tr> <td> Additional CISA KEV entries added </td> <td> 60% </td> <td> 7 days </td> <td> Two additions in 48 hours indicates elevated exploitation discovery rate </td> </tr> <tr> <td> DragonForce or CoinbaseCartel posts a U.S. government entity as a victim </td> <td> 50% </td> <td> 7 days </td> <td> Combined 656 victims, both updated within 48 hours, both target government </td> </tr> <tr> <td> MuddyWater/Iranian-nexus actors target a U.S. state government network </td> <td> 40% </td> <td> 14 days </td> <td> Campaign updated with government targeting across 17 countries; U.S. state agencies match victim profile </td> </tr> <tr> <td> HOOK SPIDER access sale leads to ransomware incident at a state/local government entity </td> <td> 35% </td> <td> 14 days </td> <td> Confirmed gov/local-gov targeting + confirmed relationships with active ransomware operators </td> </tr> <tr> <td> APT29 reconnaissance against state election infrastructure ahead of 2026 midterms </td> <td> 30% </td> <td> 30 days </td> <td> Historical pattern of APT29 pivoting to state targets during election cycles; absence of current activity is not assurance </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                   </h2> <h3>Hunt Hypotheses</h3> Hunt 1: FIRESTARTER Backdoor Activity - Hypothesis: China-nexus actors have deployed FIRESTARTER on state network endpoints via compromised edge devices. - What to look for: Unusual outbound connections from endpoints to infrastructure identified in CISA MAR AR26-113A (download full IOC set from CISA); unexpected scheduled tasks or services on systems adjacent to SOHO routers or VPN concentrators. - ATT&CK techniques: T1059 (Command and Scripting Interpreter), T1071 (Application Layer Protocol), T1105 (Ingress Tool Transfer), T1082 (System Information Discovery), T1041 (Exfiltration Over C2 Channel) - Data sources: EDR telemetry, firewall logs, DNS query logs, proxy logs Hunt 2: GopherWhisper M365 Graph API Abuse - Hypothesis: An adversary is using M365 Graph API calls to draft-email folders as a covert C2 channel. - What to look for: Anomalous Graph API calls to /me/messages or /me/mailFolders/Drafts/messages endpoints from non-standard user agents or service principals; draft emails created and deleted in rapid succession; Slack/Discord webhook traffic from server endpoints. - ATT&CK techniques: T1071.003 (Mail Protocols), T1102 (Web Service), T1567 (Exfiltration Over Web Service) - Data sources: Microsoft 365 Unified Audit Log, Azure AD sign-in logs, Cloud App Security alerts Hunt 3: ClickFix PowerShell Execution - Hypothesis: Users are being socially engineered into pasting malicious PowerShell commands from browser prompts. - What to look for:powershell.exe with -encodedcommand or -e flags spawned within seconds of browser process focus change; PowerShell downloading and executing NETSUPPORT RAT components; new entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to NETSUPPORT binaries. - ATT&CK techniques: T1204.002 (User Execution: Malicious File), T1059.001 (PowerShell), T1219 (Remote Access Software), T1547.001 (Registry Run Keys) - Data sources: EDR process creation logs, PowerShell script block logging (Event ID 4104), registry monitoring Hunt 4: CoinbaseCartel Cloud Exfiltration - Hypothesis: An adversary has compromised cloud accounts and is exfiltrating sensitive data to external cloud storage without deploying ransomware. - What to look for: Unusual volume of file downloads from SharePoint/OneDrive by a single account; OAuth token grants to unfamiliar applications; large data transfers to consumer cloud storage (Google Drive, Mega, Dropbox) from state network egress points; vishing attempts reported to helpdesk preceding account compromise. - ATT&CK techniques: T1078.004 (Valid Accounts: Cloud Accounts), T1566.004 (Phishing: Voice), T1567 (Exfiltration Over Web Service) - Data sources: CASB logs, DLP alerts, Azure AD sign-in anomalies, helpdesk ticket correlation Hunt 5: HOOK SPIDER Initial Access Indicators - Hypothesis: HOOK SPIDER has compromised or is attempting to compromise state agency infrastructure using info-stealers and ProxyShell. - What to look for: RedLine or Vidar stealer artifacts on endpoints (check for known file paths and registry keys); ProxyShell exploitation attempts against Exchange servers (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207); credentials for state agency systems appearing on dark web marketplaces or paste sites. - ATT&CK techniques: T1589.001 (Gather Victim Identity: Credentials), T1078 (Valid Accounts), T1190 (Exploit Public-Facing Application), T1555 (Credentials from Password Stores) - Data sources: EDR alerts, Exchange server logs, dark web monitoring feeds, credential leak monitoring <h3>Detection Rules to Prioritize</h3> <table> <thead> <tr> <th> Priority </th> <th> Detection </th> <th> ATT&CK ID </th> <th> Platform </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> PowerShell encoded command execution from browser child process </td> <td> T1059.001 </td> <td> EDR / Sysmon </td> </tr> <tr> <td> HIGH </td> <td> M365 Graph API draft-email rapid create/delete pattern </td> <td> T1071.003 </td> <td> M365 UAL / CASB </td> </tr> <tr> <td> HIGH </td> <td> BeyondTrust RS/PRA exploitation attempts (CVE-2026-1731) </td> <td> T1190 </td> <td> WAF / IDS </td> </tr> <tr> <td> HIGH </td> <td> Ivanti EPMM unauthenticated API access (CVE-2026-1340, CVE-2026-1281) </td> <td> T1190 </td> <td> MDM logs / WAF </td> </tr> <tr> <td> MEDIUM </td> <td> OAuth device-code flow from unexpected geolocation </td> <td> T1078 </td> <td> Azure AD Conditional Access </td> </tr> <tr> <td> MEDIUM </td> <td> Large-volume SharePoint/OneDrive download by single identity </td> <td> T1567 </td> <td> CASB / DLP </td> </tr> <tr> <td> MEDIUM </td> <td> New scheduled task or service creation on systems near network edge </td> <td> T1053 / T1543 </td> <td> EDR / Sysmon </td> </tr> </tbody> </table> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Tax Agencies)</h3> <ul> <li>Primary threat: CoinbaseCartel’s exfiltration-only model targeting financial data via cloud account compromise and vishing. Tax records and revenue data are high-value targets.</li> <li>Action: Enforce conditional access policies requiring compliant devices for all cloud access to financial systems. Deploy DLP rules specifically monitoring for bulk export of taxpayer PII. Brief helpdesk staff on vishing scenarios where callers impersonate IT support to obtain MFA codes.</li> <li>Key CVE: CVE-2026-1731 (BeyondTrust) — revenue agencies using BeyondTrust for vendor remote support must patch immediately.</li> </ul> <h3>Energy (State Energy Offices, Utility Oversight, Dam Safety)</h3> <ul> <li>Primary threat: Iranian espionage campaign explicitly targeting energy and utilities sectors; China-nexus compromised edge devices at remote energy monitoring sites.</li> <li>Action: Audit all SOHO routers and edge devices at remote energy monitoring locations against the CISA AA26-113a device list. Verify segmentation between IT and OT/SCADA networks. Review remote access pathways used by third-party energy contractors.</li> <li>Key ATT&CK: T1071 (Application Layer Protocol) — monitor for unusual outbound traffic from OT-adjacent network segments.</li> </ul> <h3>Healthcare (Medicaid, State Health Departments, Public Health Labs)</h3> <ul> <li>Primary threat: Ransomware via HOOK SPIDER access brokering — healthcare data commands premium prices on criminal markets. Ivanti EPMM vulnerabilities affect mobile devices used by field health workers.</li> <li>Action: Patch Ivanti EPMM immediately (CVE-2026-1340, CVE-2026-1281, both CVSS 9.8). Review mobile device enrollment policies — unauthenticated API access to MDM platforms could allow adversary device enrollment. Ensure Medicaid PII databases have row-level access logging enabled.</li> <li>Key CVE: CVE-2026-1340 and CVE-2026-1281 (Ivanti EPMM) — critical for any agency managing mobile health worker devices.</li> </ul> <h3>Government (All State Agencies, Courts, Legislature)</h3> <ul> <li>Primary threat: Multi-vector — FIRESTARTER espionage backdoor, ClickFix social engineering delivering NETSUPPORT RAT, HOOK SPIDER selling government network access, and GopherWhisper abusing M365 for C2.</li> <li>Action: Prioritize BlueHammer (CVE-2026-33825) patching ahead of the May 7 KEV deadline — Microsoft Defender is deployed on virtually every state endpoint. Implement PowerShell Constrained Language Mode on standard user workstations to mitigate ClickFix attacks. Audit Azure AD for OAuth applications with excessive permissions (Graph API mail read/write scopes granted to unknown apps).</li> <li>Key deadline:7 May 2026 — CISA KEV mandatory remediation for BlueHammer.</li> </ul> <h3>Aviation / Logistics (State DOT, Airports, Port Authorities)</h3> <ul> <li>Primary threat: China-nexus compromised network devices at transportation management centers and remote DOT facilities; supply chain compromise via MSPs managing traffic management and logistics systems.</li> <li>Action: Inventory all network edge devices at traffic management centers, weigh stations, and remote DOT sites against CISA AA26-113a advisory. Review MSP access controls — ensure MSP VPN accounts use MFA and are scoped to minimum necessary access. Monitor for anomalous data flows from transportation SCADA systems.</li> <li>Key ATT&CK: T1199 (Trusted Relationship) — MSP compromise is the primary initial access vector for transportation infrastructure.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>🔴 IMMEDIATE (Within 24 Hours)</h3> <ol> <li>IT Ops + 911 Authority: Contact the state’s 911/PSAP authority and verify patch status for Intrado 911 Emergency Gateway systems per CISA advisory ICSA-26-113-06. This is a life-safety system — CIO-level communication to the relevant public safety agency is warranted today.</li> <li>SOC: Download the full CISA FIRESTARTER Malware Analysis Report (AR26-113A) from cisa.gov. Extract all IOCs (hashes, IPs, domains) and ingest into SIEM and EDR platforms for retroactive hunting across all state network endpoints.</li> <li>SOC: Verify compliance with both CISA KEV additions from April 22–23. Confirm patches are deployed or mitigations are in place within BOD 22-01 timelines.</li> <li>IT Ops: Confirm BlueHammer (CVE-2026-33825) patch deployment status across all state endpoints. The CISA KEV mandatory remediation deadline is May 7, 2026 — with confirmed in-the-wild exploitation since April 16, this cannot wait.</li> </ol> <h3>🟡 7-DAY</h3> <ol> <li>IAM / Identity Team: Audit Azure AD conditional access policies to restrict or block device-code authentication flows. Block legacy authentication protocols that enable OAuth device-code phishing. Review all OAuth application grants for excessive Graph API permissions (especially Mail.ReadWrite, Files.ReadWrite.All).</li> <li>SOC / Detection Engineering: Deploy detection for ClickFix-style attacks — alert on powershell.exe with -encodedcommand spawned within 5 seconds of browser process focus loss. Enable PowerShell Script Block Logging (Event ID 4104) on all endpoints if not already active.</li> <li>Security Architecture: Review DLP policies for cloud storage exfiltration (OneDrive, Google Drive, Mega, Dropbox). CoinbaseCartel’s exfiltration-only model means no ransomware detonation alert will fire — detection depends entirely on DLP and UEBA. Ensure CASB is monitoring for bulk file downloads.</li> <li>IT Ops: Patch Ivanti EPMM (CVE-2026-1340 and CVE-2026-1281, both CVSS 9.8) and BeyondTrust Remote Support/PRA (CVE-2026-1731, CVSS 9.8). Both have active exploitation campaigns confirmed.</li> <li>Network Security: Audit all SOHO routers and edge network devices at agency branch offices and remote sites against the device types listed in CISA/Five Eyes advisory AA26-113a. Replace or isolate compromised device models.</li> </ol> <h3>🔵 30-DAY</h3> <ol> <li>CISO: Commission a security assessment of state 911/PSAP infrastructure including Intrado EGW, Computer-Aided Dispatch (CAD) systems, and NG911 components. Coordinate with state emergency management. This infrastructure may not appear in standard IT asset inventories.</li> <li>CISO: Initiate a proactive threat hunt for APT29 indicators against state election infrastructure ahead of the 2026 midterm cycle. Coordinate with the Election Assistance Commission (EAC) and CISA Election Security. The current absence of APT29 activity against state targets should not be interpreted as safety.</li> <li>CISO / IR Team: Conduct a tabletop exercise simulating a HOOK SPIDER access sale → ransomware deployment scenario against a state agency. Test incident response procedures, backup restoration timelines, and communication plans. HOOK SPIDER’s confirmed relationships with SCATTERED SPIDER, Nova RaaS, and other ransomware operators make this a realistic near-term scenario.</li> <li>Security Architecture: Implement PowerShell Constrained Language Mode on standard user workstations across all agencies to reduce the effectiveness of ClickFix and similar social engineering techniques that rely on user-executed PowerShell.</li> <li>CISO / Governance: Establish a weekly manual review of NASCIO, NCSL Cybersecurity Legislation Tracker, and congress.gov for state-relevant cybersecurity legislation and federal cyber funding developments. Automated feeds have not reliably captured legislative intelligence — this requires a human-in-the-loop process.</li> </ol> <h2>Bottom Line                                      </h2> State government IT faces a convergence of threats this week that is broader and more technically sophisticated than any single advisory conveys. China-nexus actors are running simultaneous espionage operations through compromised edge devices, M365 API abuse, and a newly disclosed backdoor — all targeting the exact technology stack state agencies depend on. Iranian actors are expanding government targeting globally. Access brokers are explicitly advertising state and local government network access to ransomware operators. A vulnerability in 911 dispatch infrastructure introduces a life-safety dimension that demands immediate executive attention. Every threat in this report has a concrete defensive action available today. The BlueHammer patch deadline is May 7. The Ivanti and BeyondTrust patches are available now. The FIRESTARTER IOCs can be hunted today. The 911 authority can be called this morning. State agencies are being targeted — the question is whether the patches get deployed, the hunts get run, and the calls get made before the next advisory is about your network. <h2>Closing                                                 </h2> The threat landscape facing state government IT this week is defined by convergence. China-nexus actors are running parallel espionage operations through compromised edge devices, M365 API abuse, and newly disclosed backdoors — all targeting the exact technology stack state agencies depend on. Iranian actors are expanding government targeting globally. Access brokers are explicitly advertising state and local government network access to ransomware operators. And a vulnerability in 911 dispatch infrastructure introduces a life-safety dimension that demands immediate executive attention. The common thread across all of these threats is that they exploit the gaps state governments know they have: legacy edge devices at remote offices, under-monitored cloud environments, mobile device management platforms that haven’t been patched, and critical infrastructure systems that don’t appear in IT asset inventories. The good news is that every threat identified in this report has a concrete defensive action. The BlueHammer patch deadline is May 7. The Ivanti and BeyondTrust patches are available now. The FIRESTARTER IOCs can be hunted today. The 911 authority can be called this morning. The question is not whether state agencies are being targeted. They are. The question is whether the patches get deployed, the hunts get run, and the calls get made before the next advisory is about your network.

FEATURED RESOURCES

April 24, 2026

Anomali Cyber Watch

Iran’s Cyber War Machine Is Accelerating — And the Ceasefire Doesn’t Cover It

April 24, 2026

Anomali Cyber Watch

Public Sector

When 911 Goes Dark: China-Nexus Backdoors, Access Brokers Selling Government Networks, and a Wake-Up Call for State IT Leaders

April 23, 2026

Anomali Cyber Watch

The Ceasefire Is a Lie: Iranian Cyber Operations Are Running at Full Tempo While the World Looks Away

Explore All